Mitsubishi Electric MELSEC iQ-R Series

MELSEC iQ-R Safety CPUs and SIL2 Process CPUs contain vulnerabilities (CWE-200 exposure of sensitive data, CWE-522 insufficiently protected credentials, CWE-645 overly restrictive allowlist) that allow a remote attacker on the network to extract legitimate user credentials or gain unauthorized access without authentication. Successful exploitation could grant an attacker the ability to modify safety-critical logic, alter control system behavior, or deny access to legitimate operators. The vulnerabilities affect firmware version 26 or earlier on Safety CPUs and version 11 or earlier on SIL2 Process CPUs. All versions of these products are vulnerable.